How long does ISO certification actually take in Kenya?
After cost, the second question we get on almost every first call is timing, usually phrased as some version of "we have a tender closing in six weeks, can we be certified by then." The honest answer is sometimes yes, more often no, and the difference almost never comes down to the certification body. It comes down to decisions the business itself makes in the first two weeks of the engagement.
The realistic range
For a business starting from genuinely nothing, no documented processes, no risk register, no internal audit history, a realistic timeline to first certification across most of the standards we work with, ISO 9001, ISO 27001, ISO 45001, ISO 14001, runs somewhere between four and nine months. A business that already runs decent informal processes and simply needs to formalise and document them against the standard can move considerably faster, sometimes in ten to twelve weeks. ISO 22301 and 27001 implementations with heavier technical and testing requirements tend to sit at the longer end of that range rather than the shorter one.
What actually determines the timeline
How much documentation already exists. Formalising what you already do is always faster than inventing a management system from a blank page.
How available leadership and process owners actually are. Implementation stalls most often not because the work is hard, but because the people who need to approve a policy, sit for an interview, or sign off a risk assessment keep rescheduling. We tell every client this upfront because it is the single biggest timeline risk inside their own control.
What Stage 1 turns up. A Stage 1 audit that finds major nonconformities pushes Stage 2 back by however long it takes to close them properly, which is often four to eight weeks depending on severity.
Certification body scheduling. Reputable certification bodies, local and international, book audit slots weeks or months ahead, especially around year-end when many organisations are chasing the same deadline. Booking early protects your timeline more than almost anything else you can do.
The stages, and where time actually goes
Gap assessment, one to two weeks. Mapping what exists against what the standard requires, and giving you an honest scope of work rather than a generic quote.
Implementation, six to twenty weeks depending on scope. Writing and embedding policies, running risk assessments, training staff, and most importantly, actually operating the system long enough to generate real records, not retrofitted ones.
Internal audit and management review, two to three weeks. A required step before Stage 1, not a formality, since this is usually where the gaps an external auditor would later find get caught internally first.
Stage 1 audit, documentation review, usually one to two days on site or remote. The auditor checks readiness and flags anything that would cause a failed Stage 2.
Corrective action window, two to eight weeks if needed. Time to close any Stage 1 findings properly before Stage 2 is booked.
Stage 2 audit and certificate issuance, two to four weeks after the audit. The full system audit, followed by the certification body's internal review before the certificate is actually issued.
A quick framework to protect your own timeline
1. Name one internal owner with real authority to get documents approved and interviews scheduled without chasing people for weeks.
2. Book your certification body audit slot as early as realistically possible, even before implementation is finished, since the slot itself is often the longer lead time than the work.
3. Build the system by actually running it, not by writing policies you intend to start following later, since auditors look for live records, not clean paperwork with no history.
4. Fix likely Stage 1 findings before Stage 1, using an internal audit to find them first.
5. Tell your consultant your real deadline on day one, not after the first missed internal milestone, so the engagement is scoped and sequenced around it from the start.
Recertification and the three-year cycle
First certification is not the end of the clock. The certificate runs for three years, with a surveillance audit in year one and year two, and a full recertification audit before year three closes. Businesses that treat the surveillance audits as a light annual check-in, rather than genuine evidence that the system is still running, are the ones who end up scrambling to rebuild it from scratch at year three. Budgeting the ongoing maintenance time, not just the initial implementation months, is part of getting the real timeline right from the outset.
If you have a tender deadline
A fixed external deadline, a tender closing date, a client ultimatum, a regulator notice, almost always means paying for a more concentrated engagement: more consultant hours per week, faster internal turnaround on approvals, and an early-booked audit slot, rather than a slower, cheaper pace. It is a trade worth having explicitly rather than discovering three months in that the original timeline was never realistic for the deadline you actually have.
Get a timeline built around your actual starting point
We would rather tell you honestly that six weeks is not realistic than take the engagement and miss your deadline quietly. If you have a real date to hit, bring it to the first conversation and we will scope the fastest realistic path to it.